CVE-2021-22194: Medium severity gitlab vulnerability
Published Mar 26, 2021
·Updated
In all versions of GitLab, marshalled session keys were being stored in Redis.
Affected Software
6 affected components
GitLab GitLab<13.7.8
GitLab GitLab<13.7.8
GitLab GitLab>=13.8.0<13.8.5
GitLab GitLab>=13.8.0<13.8.5
GitLab GitLab>=13.9.0<13.9.2
GitLab GitLab>=13.9.0<13.9.2
Event History
Mar 26, 2021
CVE Published
via MITRE·07:08 PM
Data Sourced
via MITRE·07:08 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22194?
CVE-2021-22194 is considered to have a medium severity level due to the potential risk of exposing session keys.
2
How do I fix CVE-2021-22194?
To mitigate CVE-2021-22194, upgrade to GitLab version 13.7.9 or later, or 13.8.6 or later.
3
What versions are affected by CVE-2021-22194?
CVE-2021-22194 affects GitLab versions prior to 13.7.9, and from 13.8.0 to 13.8.5, as well as from 13.9.0 to 13.9.2.
4
Is CVE-2021-22194 a remote exploit?
CVE-2021-22194 does not represent a remote exploit as it requires access to the Redis instance.
5
What are the implications of CVE-2021-22194?
CVE-2021-22194 could allow an attacker with access to Redis to access marshalled session keys, compromising user sessions.